CVE-2024-8687: PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
First published: Wed Sep 11 2024(Updated: )
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Paloaltonetworks Pan-os | >=8.1.0<8.1.25 | |
| Paloaltonetworks Pan-os | >=9.0.0<9.0.17 | |
| Paloaltonetworks Pan-os | >=9.1.0<9.1.16 | |
| Paloaltonetworks Pan-os | >=10.0.0<10.0.12 | |
| Paloaltonetworks Pan-os | >=10.1.0<10.1.9 | |
| Paloaltonetworks Pan-os | >=10.2.0<10.2.4 | |
| Paloaltonetworks Pan-os | =11.0.0 | |
| Paloaltonetworks Globalprotect | >=5.1.0<5.1.12 | |
| Paloaltonetworks Globalprotect | >=5.2.0<5.2.13 | |
| Paloaltonetworks Globalprotect | >=6.0.0<6.0.7 | |
| Paloaltonetworks Globalprotect | >=6.1.0<6.1.2 | |
| Paloaltonetworks Globalprotect | =6.2.0 | |
| All of | ||
| Paloaltonetworks Prisma Access | ||
| Paloaltonetworks Pan-os | <10.2.9 |
Remedy
This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions. It is also fixed in Prisma Access 10.2.9 and all later Prisma Access versions. To maintain GlobalProtect app functionality for the vulnerable features, we released a corresponding software update for GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.7, GlobalProtect app 6.1.2, and GlobalProtect app 6.2.1, and all later GlobalProtect app versions. To maintain the ability for end users to use the uninstall password feature and the disable or disconnect passcode feature, you must ensure that you upgrade all GlobalProtect app deployments to a fixed version before you upgrade your PAN-OS software to a fixed version. All fixed versions of GlobalProtect are backwards compatible with vulnerable versions of PAN-OS software. However, fixed versions of PAN-OS software are not backwards compatible with vulnerable versions of GlobalProtect. You can find additional information for PAN-204689 here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-0-known-and-addressed-issues/pan-os-11-1-0-known-issues Prisma Access customers can open a support case to request an upgrade.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/remedy
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/severity
- agent/tags
- vendor/paloaltonetworks
- canonical/paloaltonetworks pan-os
- version/paloaltonetworks pan-os/8.1.0
- version/paloaltonetworks pan-os/9.0.0
- version/paloaltonetworks pan-os/9.1.0
- version/paloaltonetworks pan-os/10.0.0
- version/paloaltonetworks pan-os/10.1.0
- version/paloaltonetworks pan-os/10.2.0
- version/paloaltonetworks pan-os/11.0.0
- canonical/paloaltonetworks globalprotect
- version/paloaltonetworks globalprotect/5.1.0
- version/paloaltonetworks globalprotect/5.2.0
- version/paloaltonetworks globalprotect/6.0.0
- version/paloaltonetworks globalprotect/6.1.0
- version/paloaltonetworks globalprotect/6.2.0
- canonical/paloaltonetworks prisma access